Service Port number UsedSplunk Web Port: 8000

Splunk Management Port: 8089

Splunk Indexing Port: 9997

Splunk Index Replication Port 8080

Refer Below diagram for more detailed view:

Splunk Common Network ports

Q: How to change default port numbers in splunk?

There may be certain conditions where you may need to change default port numbers used.Most of the case due to security reasons OR if other service is using the port then You can change the default values by following below steps:

Using Splunk WebTo change the ports from their installation settings:

1. Log into Splunk Web as the admin user. 2. Click Manager in the top-right of the interface. 3. Click the System settings link in the System section of the screen. 4. Click General settings. 5. Change the value for either Management port or Web port, and click Save. Using Splunk CLITo change the port settings via the Splunk CLI, use the CLI command set.

For example, this command sets the Splunk Web port to 9000:

splunk set web-port 9000

This command sets the splunkd port to 9089:

splunk set splunkd-port 9089

Q: How to check ports used by splunk in existing splunk installation/environment?

You can check port numbers used by existing splunk installation by using below commands:

./splunk show web-port ./splunk show splunkd-port

OR you need check web.conf which is located at below location:

$SPLUNK_HOME/etc/system/local/ web.conf

and find the line marked in red as below: httpport = <port_number> * Must be present for SplunkWeb to start. * If omitted or 0 the server will NOT start an http listener. * If using SSL, set to the HTTPS port number. * Defaults to 8000. mgmtHostPort = <IP:port> * Location of splunkd. * Don't include http[s]:// -- just the IP address. * Defaults to 127.0.0.1:8089.--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------